In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2375 articles
Microsoft describes a fake-download campaign that uses trojanized Inno-style installers to silently deploy proxyware, distributed-computing software, and adware-style utilities, and provides investigation and mitigation guidance.
Check Point researchers found that the Haiou Codex jailbreak modifies agent instructions to inject gateway ads into responses. They also observed the bundle in a threat actor’s toolkit, but found no evidence it was designed for cybercrime.
Researchers analyzed a signed fake “Google Workspace” MSIX that uses an .appinstaller file to obtain a server and ID, then runs server-supplied PowerShell via WebView2. The final payload was unavailable; a traffer connection is only a suspected fit.
ESET researchers detail Gorbag, a Russia-aligned actor targeting Ukrainian organizations with spearphishing and a WinRAR exploit. Its tools harvest browser credentials, VPN configurations, and files, then attempt to remove themselves.
ESET says the Russia-aligned Gorbag group targeted Ukrainian organizations with phishing and malicious RAR archives exploiting CVE-2025-8088, stealing browser credentials, VPN configurations and files with its BeautyStealer infostealer.
Analysis traces a signed funding-form decoy through DLL side-loading to an unattributed plugin-based RAT. Sandbox traffic showed an operator viewing the screen and browsing files; the article also details persistence and defensive hunting advice.
FortiGuard Labs attributes a South Asia-focused campaign to suspected BITTER with high confidence. Three Windows infection chains use LNK, URL and VHDX lures to deploy PapRAT; a Rust variant adds commands and HTTPS C2.
Researchers linked UTA0576 to a three-flaw Ivanti Connect Secure chain enabling unauthenticated root access. The investigation detailed credential and AD reconnaissance, stealth techniques, and indicators; a clean Integrity Checker result may not rule out compromise.
Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and abusing insecure AD CS configurations. In one, company data was copied to an external server; the amount was not disclosed.
Kaspersky details attacks on education organizations in Africa and Latin America using CyberStrikeAI, an LLM-orchestrated C2 framework. The investigation describes familiar domain-compromise techniques executed rapidly and explains how defenders can detect them.
Mandiant and GTIG describe 2026 intrusions in which actors abused stolen cloud credentials or exposed LLM services to resell access and generate costly model usage. Their findings detail attack methods and provide detection and mitigation guidance.
An investigation of n0n’s maritime extortion campaign found overlapping sample-file patterns consistent with a possible shared data source, but not proof of one. None of 38 published Bitcoin addresses showed incoming payments by October 22, 2026.
Google and partners say they disrupted the XCPE backdoor, which enrolled more than 1.3 million set-top boxes. Mandiant details its persistence, MQTT command channel and affiliate modules used for ad fraud, proxying and additional malware.
Morphisec analyzed an order-themed email campaign that uses obfuscated JScript to drop LuaJIT and a Lua loader, execute XLoader in memory, then transfer it into an x86 process via shared-section mapping and thread-context redirection.
Analysis finds a signed 62 MB Windows utility hiding a 9.7 KB loader that retrieves GodRAT over raw TCP and injects it into cmd.exe. The certificate also signed a separate Golden Gh0st loader, but attribution remains undetermined.
Technical analysis traces a signed, three-stage IEProc chain to Golden Gh0st RAT, linking it to APT-Q-27 through a reused plugin and C2 key. The backdoor contacted app[.]probref[.]com, but received no commands in testing.
Parameter researchers demonstrated that a malicious ChatGPT share link could run code in a logged-in session and access private chats. OpenAI fixed the flaw by October 26; the controlled test involved no real users.
Microsoft analyzed a tampered Claude Code extension briefly listed on Cursor’s marketplace. Its injected code attempted to install SSH access, create reverse tunnels, establish persistence, and report host details; successful access was not confirmed on every host.
Wiz analyzes nine AI developer-platform incidents and two enterprise keys it attributes to one vendor breach, documenting about 2.5 million Bedrock calls. It says resale operators accessed the keys, but their connection to the attacks or high-volume abuse is unproven.
Rapid7 demonstrated CVE-2026-102764 in Remote Support 24.1.2: an anonymous customer session could forge a local MRS router ID, upload a PHP file, and execute code as msfuser. Other affected releases and fixed builds remain undetermined.
Microsoft describes two intrusions starting with Teams help-desk impersonation and Quick Assist access, then diverging into AD CS ESC1 certificate abuse or PetitPotam/ESC8 NTLM relay. One led to DCSync and data exfiltration; isolation halted the other.
LevelBlue researchers linked more than 70 phishing-kit instances through shared infrastructure and code. The kits exploit Microsoft device-code sign-in to capture account tokens; researchers assess the codebase was largely AI-assisted.
Analysis of Claude Code extension artifact version 2.1.313 found code that adds an SSH key, attempts to enable SSH, creates a reverse tunnel and installs persistence. Cursor reportedly traced the malicious extension to its Marketplace, but the analyzed artifact’s origin
Researchers traced a PolinRider-related payload in four recovered npm packages from a nine-version May 2025 burst, reconstructing a blockchain-delivered RAT and credential stealer and linking later GitHub force-push infections.
